Information Commissioner's Office 


ICO’s call for views on the Direct 
marketing code of practice 


Summary of responses 


Introduction 


As required by the Data Protection Act 2018 the ICO has been working on 
a direct marketing code of practice (the code). 


In November 2018 we ran a call for views seeking stakeholder and public 
input into the development of the code. 


We received 104 written responses to the call for views, from across the 
private and public sectors, third sector organisations and trade 
associations, as well as responses from individual members of the public. 
We are grateful to those who took the time to comment. Responses from 
organisations are available to view on our website. 


This document summarises the key themes emerging from the responses 
we received to the questions we originally asked. 


We have carefully considered the views we received, and we have used 
these to inform the production of the code. The draft code is now 
published for consultation. 


Key themes 


A wide variety of issues were raised in response to the call for views. 
Whilst it is not possible to cover in detail every point that was raised, we 
have summarised the key themes that emerged from the responses below 
along with our comments on these. 


Changes in data protection legislation the code should focus on 


We asked respondents to let us know what changes to data protection 
legislation they would like us to focus on in the code. 
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The majority of responses suggested the code should focus on how the 
consent and legitimate interests lawful bases apply, including how these 
interact with the Privacy and Electronic Communications Regulations 2003 
(PECR). A large number of respondents also asked for a focus on 
transparency and the right to be informed. Dealing with individuals rights 
in the direct marketing context was also suggested. 


Whilst not strictly about changes in data protection legislation, some 
respondents said the code should cover to business to business marketing 
as well as marketing to individuals. 


ICO’s response 

It is important to remember that the ICO already has extensive guidance 
on lawful bases, consent, legitimate interests and individuals rights 
(including the right to be informed). This existing guidance can be applied 
to any purpose for processing personal data, including direct marketing. 
The draft code does not seek to duplicate all our existing data protection 
and e-privacy guidance but instead draws out particular concepts in the 
context of direct marketing. 


Transparency is a key part of the GDPR and individuals must be informed 
about your collection and use of their personal data for direct marketing 
purposes. The draft code has a section devoted to generating leads and 
collecting contact details which covers the right to be informed. 


You need to choose the most appropriate lawful basis before you start 
processing personal data for direct marketing purposes. The draft code 
covers planning your direct marketing campaigns and this includes 
guidance on lawful bases which has a particular focus on consent and 
legitimate interests. The draft code also explains how PECR may affect 
your choice of lawful basis. 


The draft code also has a section on individual rights which focuses on the 
rights that are most relevant to processing for direct marketing purposes. 


Much of the code can be applied both to direct marketing to individuals 
and to businesses. However where the rules are different this is made 
clear and it contains a specific section on business to business marketing. 


Other developments impacting on direct marketing practices 


We asked for feedback on whether there were any developments, other 
than the changes to data protection legislation, which were having an 
impact on respondents’ direct marketing practices. 
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In general those responses that identified an additional impact on their 
marketing practices referred to uncertainty about the future changes to 
the e-privacy regime. Others referred to online advertising and the use of 
new technologies for direct marketing purposes. Some respondents from 
regulated sectors mentioned the regulatory requirements within their 
sector and how these interact with the direct marketing rules. 


ICO’s response 

We appreciate that there is uncertainty about the draft e-privacy 
Regulation (ePR) which is intended to replace the e-privacy Directive on 
which PECR is based. However the draft code covers the legislation as it 
currently stands - which for e-privacy means the Privacy and Electronic 
Communications Regulations 2003 (PECR). 


The methods of direct marketing continue to evolve and are no longer 
limited to ‘traditional’ forms such as post, email and phone calls. The draft 
code acknowledges this and as well as guidance on these ‘traditional’ 
methods it contains a section covering online advertising and the use of 
new technologies in direct marketing. 


The draft code starts with a section looking at the definition of direct 
marketing to help you decide if the code applies to you. 


Producing the code before the e-Privacy Regulation (ePR) is 
agreed 


We asked respondents to let us know whether they agreed with our 
approach of producing a direct marketing code that takes into account the 
current legislation, and then revising it once the ePR is finalised and the 
UK position in relation to it is clear. 


A small number of responses expressed concern about potential 
disruption if a second version of the code was subsequently produced that 
took into account any new e-privacy rules. However the vast majority of 
respondents agreed with our approach and felt it was beneficial to have 
the code as soon as possible without waiting for the new ePR. 


ICO’s response 

We believe it would be confusing and unhelpful to provide guidance on 
draft legislation which is still subject to change. It is not clear when the 
proposed ePR will be finalised and we believe that is better to produce a 
code now that covers the law as it currently stands (which for e-privacy 
means PECR). However once the ePR is finalised and the UK’s position in 
relation to this is clear we will produce a revised code. 
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Relevance of existing direct marketing guidance 


The call for views asked respondents how relevant the ICO’s existing 
direct marketing guidance was to their organisation. We also asked for 
any suggestions of additional areas that the code should cover. 


Most responses confirmed that the existing guidance was still relevant. 
However many asked that the code contain guidance about online 
advertising and direct marketing using social media. 


A number of respondents also requested that the code was more tailored 
to their sector in particular. 


ICO’s response 

We acknowledge that the previous direct marketing guidance was focused 
on ‘traditional’ forms of direct marketing. The draft code seeks to remedy 
this by including a section on online advertising and new technologies 
which includes guidance on direct marketing using social media. 


Our focus is on guidance of general application rather than sector specific 
guidance. However, where appropriate we will continue to seek to identify 
and engage with sectoral representatives to provide sector specific advice 
which can inform key pieces of guidance produced by influential industry 
bodies. 


In general the rules on direct marketing apply to all sectors equally. 
Where differences in the rules can arise is in regard to the type of direct 
marketing (eg promotion of aims and ideals is not covered by the PECR 
‘soft opt-in’) or whether the marketing is sent to a business or an 
individual. Where there are differences in the rules these are clearly set 
out in the draft code. There are a number of examples related to different 
sectors. 


Ease of finding information in existing direct marketing guidance 


We asked respondents how easy it was to find information in our existing 
direct marketing guidance. We also asked whether they had any 
suggestions on how we should structure the code. 


The majority of responses found it easy to find information in the existing 
guidance and many found the existing direct marketing checklists helpful. 
However some respondents felt that the content was repetitive in places 
and did not like that the old guidance sometimes split issues across 
different sections. 
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Suggestions from respondents included: 


having each method of direct marketing covered separately; 
better integration between GDPR and PECR issues; 

clear distinction between what the law requires and good practice; 
separating out direct marketing to individuals and business to 
business marketing; 

e specific examples for different sectors; and 

e checklists, tables, decision trees and a glossary of terms. 


ICO’s response 

The draft code takes a ‘life-cycle’ approach to direct marketing which 
starts with determining if your purpose or activity is direct marketing then 
moves on to planning and collecting data, then covers other topics such 
as contacting individuals with direct marketing, working with others and 
individual rights. 


There are practical examples throughout the code along with a glossary of 
key terms. The code also contains ‘good practice recommendations’ and 
further reading links to provide context and further guidance on specific 
issues. We also intend to produce additional practical tools outside of the 
code to support your direct marketing activities. 


Other suggestions for the code 


We asked respondents if there was anything they would like to see 
included in the code. 


We had a variety of suggestions of what to include in the content of the 
code. This included: 


covering what does and does not constitute direct marketing; 
greater explanation of the PECR ‘soft opt-in’; 

sharing data for direct marketing purposes; 

buying marketing lists; 

using third parties for direct marketing purposes; 

guidance on different sources of personal data; and 

guidance on suppression. 


Some respondents also reiterated points that have already been covered 
above for example more guidance on legitimate interests, consent, 
business to business marketing and new technologies. 
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ICO’s response 

We have carefully considered the comments received. Although it is not 
possible to cover all the areas suggested for the draft code, we have 
sought to cover the main points and issues. 


Next steps 


The comments received in the call for views have contributed to the draft 
Direct marketing code of practice. We are now running a consultation on 
the draft code to seek further input from stakeholders and the public. 


Direct marketing code - Call for views - Summary of responses 
V1.0 December 2019 6 


